total_replay_tool

Author: t-contreras

total_replay/readme.md

@@ -132,6 +132,35 @@ From there, you can choose whether to replay only detection GUIDs, only analytic
 
 C. TOTAL-REPLAY downloads the required Attack Data each time you execute or replay data during detection testing or development. To help reduce disk space usage, the tool generates a cached .yml file for every downloaded dataset. You can then use the `local_data_path` parameter to replay the cached data, allowing you to avoid downloading the same Attack Data again.
 
+### Other
+
+or replaying captured datasets or event logs during detection development or testing outside of the Splunk Security Content or Splunk Attack Data GitHub repositories, we recommend using the built-in replay.py feature provided by either Splunk Attack Range or Attack Data.
+
+If you have multiple datasets to replay and your metadata matches the format required by TOTAL-REPLAY for caching downloaded datasets, you can recreate that format and use the `local_data_path` feature to replay the data directly from the cache.
+
+Below is an example of the cached .yml file generated by TOTAL-REPLAY after replaying datasets:
+
+```
+analytic_story:
+- Ransomware
+attack_data_link: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log
+attack_data_output_file_path: /Users/tecontre/Research/lab/attack_range/total_replay/output/2025-11-18/detection_name_replay_c2ffd320-bcd3-4d88-9d12-57bdd30f6545/01d29b48-ff6f-11eb-b81e-acde48001123/windows-sysmon_7z.log
+attack_data_source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+attack_data_sourcetype: XmlWinEventLog
+description: The following analytic detects the execution of 7z or 7za processes with
+  command lines pointing to SMB network shares. It leverages data from Endpoint Detection
+  and Response (EDR) agents, focusing on process names and command-line arguments.
+  This activity is significant as it may indicate an attempt to archive and exfiltrate
+  sensitive files to a network share, a technique observed in CONTI LEAK tools. If
+  confirmed malicious, this behavior could lead to data exfiltration, compromising
+  sensitive information and potentially aiding further attacks.
+id: 01d29b48-ff6f-11eb-b81e-acde48001123
+mitre_attack_id:
+- T1560.001
+name: 7zip CommandLine To SMB Share Path
+
+```
+
 ## Author
 
 * [Teoderick Contreras](https://www.linkedin.com/in/teoderickc/)